pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data.
Metrics
Affected Vendors & Products
No data.
No data.
No data.
No data.
Advisories
No advisories yet.
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
| Link | Providers |
|---|---|
| https://github.com/pgadmin-org/pgadmin4/issues/9368 |
|
History
Thu, 11 Dec 2025 18:45:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files. This issue allows attackers to inject and execute arbitrary commands on the server hosting pgAdmin, posing a critical risk to the integrity and security of the database management system and underlying data. | |
| Title | Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) | |
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: PostgreSQL
Published:
Updated: 2025-12-11T19:35:35.769Z
Reserved: 2025-11-28T17:30:53.262Z
Link: CVE-2025-13780
Vulnrichment
No data.
NVD
Status : Received
Published: 2025-12-11T19:15:52.857
Modified: 2025-12-11T19:15:52.857
Link: CVE-2025-13780
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
No weakness.